samba.git/source4/heimdal/kdc, branch master

heimdal: Ensure that HDB_ERR_NOT_FOUND_HERE, critical for the RODC, is not overwritten

2015-01-23T04:42:07+00:00

This change ensures that our RODC will correctly proxy when asked to provide
a ticket for a service or user where the keys are not on this RODC.

Signed-off-by: Garming Sam 
Pair-programmed-with: Garming Sam 
Signed-off-by: Andrew Bartlett

heimdal: Really bug in KDC handling of enterprise princs

2015-01-23T04:42:07+00:00

The value of this commit to Samba is to continue to match Heimdal's
upstream code in this area.  Because we set HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL
there is no runtime difference.

(commit message by Andrew Bartlett)

Cherry-pick of Heimdal commit 9aa7883ff2efb3e0a60016c9090c577acfd0779f

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam 

Reviewed-by: Andrew Bartlett

heimdal: Fix bug in KDC handling of enterprise principals

2015-01-23T04:42:07+00:00

The useful change in Samba from this commit is that we gain
validation of the enterprise principal name.

(commit message by Andrew Bartlett)

Cherry-pick of Heimdal commit c76ec8ec6a507a6f34ca80c11e5297146acff83f

Reviewed-by: Garming Sam 
Signed-off-by: Andrew Bartlett 

Reviewed-by: Andrew Bartlett

heimdal: Only indicate successful authentication after successful authz

2014-04-02T15:12:47+00:00

This is needed to match Windows behaviour for NTLM logins.

Andrew Bartlett

Change-Id: I142de19b480cd6499d6f7f025f655e220558d54c
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

heimdal: Match windows and return KRB5KDC_ERR_CLIENT_REVOKED when the account is locked out

2014-04-02T15:12:47+00:00

Change-Id: I3c306d1516aa569549f5f024fe1fff2d4f2abefc
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

heimdal: Do not attempt password authentication for locked out accounts

2014-04-02T15:12:47+00:00

Change-Id: I49695cc4ae0dd0b02034e5411b277882ec5f5f44
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

heimdal: remove checking of KDC PAC signature, delegate to wdc plugin

2012-01-12T07:02:54+00:00

The checking of the KDC signature is more complex than it looks, it may be of a different
enc type to that which the ticket is encrypted with, and may even be prefixed
with the RODC number.

This is better handled in the plugin which can easily look up the DB for the
correct key to verify this with, and can also quickly determine if this is
an interdomain trust, which we cannot verify the PAC for.

Andrew Bartlett

heimdal: handle referrals for 3 part DRSUAPI SPNs

2011-10-04T04:08:57+00:00

This handles referrals for SPNs of the form
E3514235-4B06-11D1-AB04-00C04FC2DCD2/NTDSGUID/REALM, which are
used during DRS replication when we don't know the dnsHostName of the
target DC (which we don't know until the first replication from that
DC completes).

We use the 3rd part of the SPN directly as the realm name in the
referral.

Pair-Programmed-With: Andrew Bartlett

heimdal: Try to handle the PAC checking when we are in a cross-realm environment

2011-09-05T09:19:25+00:00

s4:heimdal: import lorikeet-heimdal-201107241840 (commit 0fdf11fa3cdb47df9f5393ebf36d9f5742243036)

2011-07-26T00:16:08+00:00